Skip to content
CUNICULA

KeePassXC

Offline encrypted password manager with no cloud and no subscription.

keepassxc.org

Offline encrypted password manager with no cloud and no subscription.

Common useOffline password storagePrivacy ToolsOperator dataNone hosted
Identity checksZero KYCNo document check recorded · identity exposure level 0/4
Evidence and riskVerified evidenceStandardMaterial claims checked against current sources.; no material risk recorded in them.
Last reviewedReviewed 7 Aug 2026KYC checked 7 Aug 2026 · unknown jurisdiction · Source → official siteHow to cite this pageSource coverageVerified evidenceRecorded riskStandard
Evidence and facts

Evidence and facts

CUNICULA SCORE 4.0
40/100Limited evidencePrivacy 12/25 · Control 0/20 · Transparency 0/20 · Security 25/25 · Accountability 3/10 · Cap 69 · Method
JURISDICTIONUnknown
NOTEThe app and password database remain local. The website collects anonymized IP address, user-agent, referrer, screen, and geolocation metrics through self-hosted Matomo; visitor logs are retained for 90 days and detailed reports for 12 months. GitHub update checks and user-requested favicon downloads create optional network connections. CVE-2026-4158 affected Windows releases through 2.7.11 and is patched in the current 2.7.12 release.
AUDITED BYNo audit listed
OPERATOR DATANo hosted operator data recorded
SOURCE COVERAGE
Verified evidenceSELF-REPORTED1/1Reviewed 7 Aug 2026 · Source → official site
LAST CHECKED2026-08-07
LAST UPDATED2026-08-07

Specs

DOCUMENT CHECKNone recorded
IDENTITY EXPOSURELevel 0/4
KYC TRIGGERSNo account and no identity check. The database is a local encrypted file, so there is no signup, no subscription, and no operator holding credentials.
FEEFree (GPLv3)
CATEGORIESPrivacy Tools
COMMON USESOffline password storage, Avoiding subscription password managers, Local encrypted credential vaults
FEATURESOffline encrypted database, No cloud and no account, Windows, macOS, and Linux, Browser integration, Auto-type, Attachments and notes, ANSSI Security Visa, GPLv3 licensed, +1 more
TORNot listed
REGIONSGlobal availability
Review analysis, source material, related services, and history

About

Offline password manager keeping credentials in a local encrypted file. No account, no cloud, no subscription. GPLv3.

Frequently Asked Questions

Is identity verification required?

No identity verification is recorded for typical use. No account and no identity check. The database is a local encrypted file, so there is no signup, no subscription, and no operator holding credentials.

Which payment methods are accepted?

Please check the provider site for accepted payment methods.

Where is it available?

Recorded availability: GLOBAL.

Is the operator based in a Five Eyes country?

The jurisdiction is not publicly confirmed. Check the provider site for incorporation details.

How are identity, operator, and evidence fields reported?

Identity exposure is level 0 of 4. No hosted operator data is recorded. Jurisdiction is shown as context, not a safety verdict. Source coverage is verified evidence, last reviewed 2026-08-07, and recorded risk is standard.

Related Services

Sources and history

Terms and privacy policy

No changes to the document we watch since we started checking on 9 Aug 2026. Last checked 9 Aug 2026.

Evidence basis: Claims on this page are linked to published sources for comparison, not certification, audit, endorsement, or recommendation; read the methodology and coverage map before relying on an entry.